CVE-2026-46407: Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46407?
CVE-2026-46407 has a high severity rating due to the potential for unauthorized access to administrator REST API tokens.
How do I fix CVE-2026-46407?
To mitigate CVE-2026-46407, upgrade to Vvveb version 1.0.8.3 or later.
What impact does CVE-2026-46407 have on my Vvveb installation?
CVE-2026-46407 can lead to unauthorized disclosure of administrative API tokens, potentially compromising the security of your Vvveb installation.
Who is affected by CVE-2026-46407?
All users of Vvveb versions prior to 1.0.8.3 are affected by CVE-2026-46407.
What is the primary issue with CVE-2026-46407?
CVE-2026-46407 allows an authenticated administrator to unintentionally disclose REST API tokens due to an Insecure Direct Object Reference (IDOR) vulnerability.